CVE Alert: CVE-2026-108863 – Katanemo

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the Envoy admin interface, which is bound to all host interfaces on port 9901. Attackers can request the /config_dump endpoint to read configured LLM provider API keys in plaintext from the WASM filter configuration.

**Risk verdict:** Treat exposed instances as high risk: a remote, unauthenticated party may obtain secrets, but urgency cannot be calibrated against active exploitation because KEV, SSVC, PoC and EPSS data were not supplied.

**Why this matters:** Leaked provider credentials could let an attacker consume paid inference services, access provider-side data, or use the organisation’s account as a platform for further abuse. The immediate impact is primarily confidentiality and credential misuse, rather than direct service disruption.

**Most likely attack path:** An attacker can reach the management interface over the network with low effort; no privileges, user action or special attack conditions are indicated. Scope is unchanged, but stolen credentials may enable activity in external provider accounts, creating downstream exposure beyond the affected service.

**Who is most exposed:** Prioritise internet-accessible deployments and environments where the admin listener is reachable from untrusted or broadly shared networks. Containerised or cloud-hosted inference gateways may be exposed through permissive port publishing or security-group rules.

Review inbound connection and proxy logs for access to port 9901 and `/config_dump`.

egress and provider audit logs for unusual API-key use, spend, or source locations.

Check whether configuration dumps or credentials were captured in logs, support bundles, or monitoring systems.

Mitigation and prioritisation

Upgrade to a vendor-fixed release; verify the fix and confirm the admin interface is no longer unauthenticated.

Until patched, block access to port 9901 at host, network and cloud controls; do not rely on obscurity.

Rotate provider credentials that may have been exposed, then review their use and scope.

Apply changes through normal change control, but expedite where the interface is externally reachable; no EPSS or exploitation-status evidence is available to refine priority.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.